> so you need some plausible story to trick the user into not reporting the incident to IT.

Give them an authentic-looking "updating windows" screen after login, and reboot. 95% of users will bitch about Microsoft, instead of calling IT.